Docs / Obsidian Vault / Staying safe
Two-step login and devices
With two-step login, your master password alone is not enough to sign in on a new device: you also need something you have, such as your phone or a security key. Set it up in Settings > Security. You need your master password to change anything there.
The methods
| Method | How it works |
|---|---|
| Authenticator app | Scan the QR code with an app like Microsoft Authenticator, Google Authenticator or Authy (or copy the key), then type the 6-digit code it shows to turn it on. Each code works once. |
| Security keys and passkeys | Add a hardware key (such as a YubiKey) or a passkey, and give it a name so you can tell them apart. Up to 10. |
| Email codes | A 6-digit code sent to your email address each time. The weakest method: anyone who gets into your mail gets the code. |
| Recovery code | One code that turns two-step login off if you lose your phone and keys. |
You can turn on several; at sign-in you choose which to use.
Your recovery code
Get it as soon as you turn on two-step login, print it or write it down, and keep it somewhere safe away from your computer. It is shown once. Asking for a new one replaces the old one.
Signing in with the recovery code turns every two-step method off and removes remembered devices, so you can set them up again. It also takes you out of any organization that requires two-step login, and we email you to say it was used.
Remembered devices
When you sign in, Remember this device skips the second step on that browser or device for 30 days.
Organizations that require it
An organization can require two-step login. You then can't be confirmed as a member without it, and you can't turn off your last method while you belong.
Devices
Settings > Security also lists every browser, extension and app signed in to your account: its name, when it was last used and from which network address, and when it was first seen. Sign out a device you don't recognize or no longer use; it is signed out within moments.
We email you when a new device signs in, and when a sign-in token is used twice (a sign it may have been copied, in which case we sign that device out).
When you change your master password, you can choose to sign out all your other devices at the same time.